Authorization and Access Token

Authorization Methods:

• bearerAuth: HTTP Bearer, JWT format (Authorization header).
• apikeyAuth: API key in the x-api-key header.

Method 1: API Key (apikeyAuth)

A permanent key that you create in advance via POST /apikeys (see section 6.5.4).

• Request header: x-api-key: <your_key>
• The key has no expiration date. Delete via POST /apikeys/delete.
• Does not require a device password and does not require the /unlock endpoint — simply include the key in the header of each request.
• Suitable for scripts, automation, Postman collections, and external integrations.

Method 2: Bearer Token / JWT (bearerAuth)

A temporary token that can be obtained on demand using the device password. How to obtain a token:

1. Send the device password in the request body to POST /unlock:

{"pw":"device_password"}

1. If the password is correct, the server will return a token:

{"token":"eyJhbGciOiJIUzI1NiIs..."}

1. This token is then included in the header of each subsequent request:

   Authorization: Bearer eyJhbGciOiJIUzI1NiIs...